Every managed CLI failure collapsed into a single "error" status, so a checksum
mismatch, a rejected redirect, an unreachable release server and an unsupported
system all produced the same unactionable message. That hides the one case worth
acting on: a verification failure is a tampering signal, not network noise.

failure_status maps a raised failure onto a bounded status: unverified for a
refused download, network for an unreachable server, unsupported for a system
with no official build, error for everything else. Reasons stay generic; no
path, command output or remote text is exposed. ManagedCli.js accepts the new
statuses and keeps the known installation visible across a failed attempt.
install() also probes the platform before calling the release API.

Also restores missing spaces in the second-copy confirmation translation, which
PO concatenation had glued into "widget.L'installazione", "widget;gli" and
"effettosul" in all five catalogs since the string was introduced.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>